CVE-2024-28085

Vulnerability Description

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://www.openwall.com/lists/oss-security/2024/03/27/5ExploitMailing ListThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/27/6Mailing ListThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/27/7Mailing ListPatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/27/8Mailing ListPatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/27/9Mailing ListPatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/28/1Mailing ListPatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/28/2Mailing ListThird Party Advisory
• http://www.openwall.com/lists/oss-security/2024/03/28/3Mailing ListPatchThird Party Advisory
• https://github.com/skyler-ferrante/CVE-2024-28085ExploitThird Party Advisory
• https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjqBroken Link
• https://lists.debian.org/debian-lts-announce/2024/04/msg00005.htmlMailing ListThird Party Advisory
• https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/Product
• https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txtExploitThird Party Advisory
• https://security.netapp.com/advisory/ntap-20240531-0003/Third Party Advisory
• https://www.openwall.com/lists/oss-security/2024/03/27/5Mailing ListThird Party Advisory